Robust systems start with clear rules.

VKTIS is a consulting and implementation firm. We do not sell a certified compliance product, and we do not claim certifications we do not hold. What we do is scope every project so that regulated information is handled by the right systems, under the right agreements, with a person accountable for each decision.

• Your accounts, your data. We build inside systems your business owns, so records, phone numbers and automations stay with you.
• Minimum necessary access. We ask only for the access a task needs, through named user accounts or delegated access, and remove it at handover.
• Human fallback. AI receptionists, chatbots and follow-up sequences hand off to your staff for sensitive, clinical, legal or uncertain situations.
• Written scope first. Data types, systems, responsibilities and acceptance criteria are agreed in writing before any build begins.
• Shared responsibility. Your business remains responsible for its own regulatory obligations. We design and document workflows to support them and coordinate with your counsel or compliance officer.

For medical, dental, med-spa, home-health and other healthcare clients, workflows are designed around HIPAA and applicable state health-privacy laws.

• HIPAA Privacy, Security and Breach Notification Rules. We design workflows so protected health information (PHI) is created, stored and sent only in systems covered by a business associate agreement (BAA) with your practice, such as your EHR, practice-management system or a HIPAA-eligible phone, messaging or CRM vendor.
• Business associate agreements. VKTIS scopes healthcare work so that VKTIS does not need to access PHI. If a workflow would require VKTIS to create, receive, maintain or transmit PHI, a BAA must be signed before that work starts; otherwise we redesign the workflow so PHI stays in your covered systems.
• No clinical decisions by automation. AI receptionists and chat tools handle scheduling, routing and general questions. Clinical, medication, diagnosis and emergency questions go to your licensed staff, and callers are told how to reach emergency services.
• Minimum necessary. Intake forms, call summaries and texts collect only what the next step needs. Appointment reminders avoid treatment details.
• State laws. We account for stricter state rules where they apply, such as the California Confidentiality of Medical Information Act, and for the FTC Health Breach Notification Rule for health apps outside HIPAA.
• Audit-ready documentation. Each build includes a record of data flows, systems, access holders and vendor agreements your compliance officer can review.

Every phone, SMS and email workflow is built around the consent and disclosure rules that apply to outreach in the United States.

• TCPA. Marketing calls and texts that use automated systems or artificial or prerecorded voices require prior express written consent. The FCC has confirmed that AI-generated voices count as artificial voices under the TCPA.
• Carrier registration. Business texting is set up with A2P 10DLC or toll-free verification, clear opt-in language, and STOP and HELP handling.
• Call recording. Recording and transcription follow all-party consent rules where required, including California Penal Code section 632, with a clear notice at the start of the call.
• Bot disclosure. AI agents identify themselves as automated where required, including under California’s bot disclosure law, and offer a path to a person.
• CAN-SPAM. Marketing email includes accurate sender details, a physical address and a working unsubscribe link honored promptly.
• Quiet hours and opt-outs. Follow-up sequences respect time-of-day limits, do-not-contact lists and stop conditions.

Workflows that collect personal information are designed so your business can meet the privacy laws that apply to it.

• CCPA and CPRA (California) and other comprehensive state privacy laws: clear notices, data minimization, and the ability to find, export or delete a person’s records on request.
• Data processing terms. Where your business requires a data processing addendum or vendor questionnaire, we review and respond before work begins.
• Retention. Automations keep records only as long as your retention policy requires, and transcripts or logs are not kept in tools outside your control.
• International visitors. If your business serves people outside the United States, we flag requirements such as the GDPR during scoping.

The same approach applies to every sector we serve: identify the rules first, then build within them.

• Legal. Intake and follow-up support confidentiality and supervision duties under ABA Model Rules 1.1, 1.6 and 5.3 and ABA Formal Opinion 512 on generative AI. Automation does not give legal advice or form attorney-client relationships, and conflict checks stay with the firm.
• Financial services and insurance. Workflows support the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, with access controls, encryption in transit and vendor oversight.
• Payments, retail and hospitality. Card numbers are never collected by chat, text, voicemail or email. Payments go through PCI DSS-compliant processors and hosted payment links.
• Reviews and marketing. Review requests follow the FTC rule on consumer reviews and testimonials: no fake, purchased or selectively filtered reviews.
• Construction and home services. Quotes, scheduling and follow-up keep license details, estimates and change approvals accurate and traceable to a person.
• Accessibility. Websites and customer-facing tools we build target WCAG 2.1 AA to support ADA accessibility obligations.

Security is part of the scope, not an add-on.

• Multi-factor authentication on every account we use, and no shared passwords. Access is granted through named users, delegated access or a password manager.
• Encryption in transit for integrations, and secrets kept out of code and documents.
• Vendor review before recommending a tool, including its security documentation and whether it will sign the agreements your industry requires.
• AI tools configured so client data is not used for model training where the vendor offers that setting, with sensitive data kept out of prompts.
• Testing with sample or de-identified data wherever possible before live data is connected.
• Prompt notice to your business if we become aware of a security incident affecting your systems, and cooperation with your response.
• Access removal and a credentials checklist at handover.

Each project is governed by a written agreement. These are the commitments built into how VKTIS works.

• Written scope. A statement of work lists deliverables, systems, data types, exclusions, client responsibilities, timeline and price before work begins.
• Confidentiality. Client information is kept confidential. A mutual nondisclosure agreement can be signed before discovery.
• Acceptance criteria. Builds are tested against criteria agreed in advance, with documentation and training at handover.
• Change control. Scope changes are agreed in writing, with any price or timeline effect stated before work proceeds.
• Warranty. Build engagements include a 60-day warranty on delivered work, as described on the pricing page.
• Third-party services. Software, telephony, messaging and AI usage fees are billed by those providers under their own terms, in your business’s name.
• No guaranteed outcomes. We commit to agreed deliverables and quality, not to revenue or regulatory outcomes that depend on factors outside the system.

• Main office: Dover, Delaware
• Regional presence: Torrance, California

VKTIS works with businesses across the United States, remotely and on site by arrangement. Questions about compliance requirements for a specific project are welcome on an intro call or at contact@vktis.com.

This page describes VKTIS practices and summarizes rules that commonly apply to our clients. It is general information, not legal advice, and does not create a certification or a contract. Your business should confirm its obligations with qualified counsel. Specific terms are set out in each signed agreement. See also the website terms and privacy notice.